On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 (Critical). The vulnerability can allow an unauthenticated attacker to make WordPress include a readable PHP file from outside the active theme directory.
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
About this summary. This is a short, independently written summary of an article first published by Wordfence. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wordfence.com/blog/2026/09/psa-critical-unauthenticated-path-traversal-vulnerability-patched-in-wordpress-core/
Source attribution: headline and facts are from Wordfence (wordfence.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Check Point Fixes a New Actively Exploited Critical Security Flaw
Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has…
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw…
Check Point security advisory (AV26-902) – Update 1
Serial Number: AV26-902 Date: September 9, 2026 Updated: September 22, 2026 As of September 9, 2026, Check Point is affected by vulnerabilities in the following…
Siemens Industrial Edge Management
View CSAF Summary Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account…
Fastly gives enterprises real-time control over AI models and agents
Fastly has announced AI Runtime Control, AI Firewall, and new API Security capabilities designed to give organizations real-time visibility and control across their AI…
CVE-2026-91843: Check Point Root RCE
CVE-2026-91843: Check Point Root RCE Check Point has patched CVE-2026-91843, a critical stack-based buffer overflow flaw in the login process of its Security Management…